We have a contract with our hosting provider that specifies what data they may collect, the limited purposes for which they can use it, and when it must be dele

We have a contract with our hosting provider that specifies what data they may collect, the limited purposes for which they can use it, and when it must be deleted. This is called a Data Processing Agreement and is also part of GDPR compliance. We have the same thing in place with all 3rd party vendors.